syzbot

 sign-in | mailing list | source | docs
🐞 Open [1646]
≡ Subsystems
🐞 Fixed [6009]
🐞 Invalid [14804]
⬇ Missing Backports [135]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KASAN: null-ptr-deref Write in io_wq_cancel_all

Status: closed as invalid on 2019/11/19 02:34
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+d958a65633ea70280b23@syzkaller.appspotmail.com
First crash: 1922d, last: 1916d
Cause bisection: introduced by (bisect log) :
commit d5f773aba1186142d52aef8242a426310a39fa86
Author: Jens Axboe <axboe@kernel.dk>
Date: Thu Oct 24 13:25:42 2019 +0000

  io_uring: replace workqueue usage with io-wq

Crash: BUG: unable to handle kernel NULL pointer dereference in io_wq_cancel_all (log)
Repro: syz .config
  
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
KASAN: null-ptr-deref Write in io_wq_cancel_all 4 (7) 2019/10/27 06:33

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in set_bit include/asm-generic/bitops-instrumented.h:28 [inline]
BUG: KASAN: null-ptr-deref in io_wq_cancel_all+0x28/0x2a0 fs/io-wq.c:574
Write of size 8 at addr 0000000000000004 by task syz-executor.5/9087

CPU: 0 PID: 9087 Comm: syz-executor.5 Not tainted 5.4.0-rc4-next-20191025 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 __kasan_report.cold+0x5/0x41 mm/kasan/report.c:510
 kasan_report+0x12/0x20 mm/kasan/common.c:634
 check_memory_region_inline mm/kasan/generic.c:185 [inline]
 check_memory_region+0x134/0x1a0 mm/kasan/generic.c:192
 __kasan_check_write+0x14/0x20 mm/kasan/common.c:98
 set_bit include/asm-generic/bitops-instrumented.h:28 [inline]
 io_wq_cancel_all+0x28/0x2a0 fs/io-wq.c:574
 io_ring_ctx_wait_and_kill+0x1e2/0x710 fs/io_uring.c:3679
 io_uring_release+0x42/0x50 fs/io_uring.c:3691
 __fput+0x2ff/0x890 fs/file_table.c:280
 ____fput+0x16/0x20 fs/file_table.c:313
 task_work_run+0x145/0x1c0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0x904/0x2e60 kernel/exit.c:817
 do_group_exit+0x135/0x360 kernel/exit.c:921
 get_signal+0x47c/0x24f0 kernel/signal.c:2734
 do_signal+0x87/0x1700 arch/x86/kernel/signal.c:815
 exit_to_usermode_loop+0x286/0x380 arch/x86/entry/common.c:159
 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
 do_syscall_64+0x65f/0x760 arch/x86/entry/common.c:300
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459f39
Code: Bad RIP value.
RSP: 002b:00007fa31eea1cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000075bfd0 RCX: 0000000000459f39
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000075bfd0
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000075bfd4
R13: 00007ffc37d99a6f R14: 00007fa31eea29c0 R15: 000000000075bfd4
==================================================================

Crashes (205):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/27 15:42 linux-next 139c2d13c258 25bb509e .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/10/27 13:24 linux-next 139c2d13c258 25bb509e .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/10/27 09:49 linux-next 139c2d13c258 25bb509e .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/10/27 03:37 linux-next 139c2d13c258 25bb509e .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/10/27 03:16 linux-next 139c2d13c258 25bb509e .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/10/27 02:49 linux-next 139c2d13c258 25bb509e .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/10/27 02:35 linux-next 139c2d13c258 25bb509e .config console log report syz ci-upstream-linux-next-kasan-gce-root
2019/10/31 06:09 linux-next fdbc6c104f95 a41ca8fa .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/31 03:32 linux-next fdbc6c104f95 a41ca8fa .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/31 01:41 linux-next fdbc6c104f95 a41ca8fa .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/31 00:29 linux-next fdbc6c104f95 a41ca8fa .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/30 22:56 linux-next fdbc6c104f95 a41ca8fa .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/30 21:56 linux-next fdbc6c104f95 a41ca8fa .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/30 18:49 linux-next fdbc6c104f95 5ea87a66 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/30 10:55 linux-next fdbc6c104f95 5ea87a66 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/30 08:48 linux-next fdbc6c104f95 5ea87a66 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/30 04:27 linux-next c57cf3833c66 5ea87a66 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/30 00:54 linux-next c57cf3833c66 5ea87a66 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/29 23:22 linux-next c57cf3833c66 5ea87a66 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/29 21:21 linux-next c57cf3833c66 5ea87a66 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/29 19:41 linux-next c57cf3833c66 5ea87a66 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/29 17:15 linux-next c57cf3833c66 5ea87a66 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/29 15:02 linux-next c57cf3833c66 5ea87a66 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/29 13:07 linux-next c57cf3833c66 5ea87a66 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/29 10:25 linux-next c57cf3833c66 5ea87a66 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/29 07:49 linux-next 60c1769a45f4 5ea87a66 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/29 05:25 linux-next 60c1769a45f4 5ea87a66 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/29 02:36 linux-next 60c1769a45f4 439d7b14 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/29 01:16 linux-next 60c1769a45f4 439d7b14 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/28 19:53 linux-next 60c1769a45f4 439d7b14 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/28 16:07 linux-next 60c1769a45f4 439d7b14 .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/28 14:42 linux-next 60c1769a45f4 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/28 13:21 linux-next 60c1769a45f4 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/28 11:40 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/28 10:19 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/28 08:32 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/28 05:32 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/28 04:30 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/27 23:48 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/27 22:33 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/27 22:08 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/27 21:06 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/27 18:53 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/27 17:34 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/27 14:57 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/27 12:44 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/27 09:34 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/27 06:40 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/26 18:27 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/26 16:41 linux-next 139c2d13c258 25bb509e .config console log report ci-upstream-linux-next-kasan-gce-root
2019/10/25 11:25 linux-next 139c2d13c258 d01bb02a .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.